fix: security vulnerability docker-ptf - #27059
Merged
yejianquan merged 1 commit intoMay 1, 2026
Merged
Conversation
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the docker-ptf container build to address security findings by adjusting Python dependencies and adding additional OS package upgrade steps within the Docker image build.
Changes:
- Removed
enum34from the Python dependency install list. - Added a pip upgrade for
lxml(and combined it with the existingsetuptoolsupgrade). - Removed the in-image build of
gnmicfrom source and added a finalapt-get update/upgrade/dist-upgradestep near the end of the Dockerfile.
| # steps so nothing slips through. | ||
| # Covers OpenSSL, openssh, libpng, gdk-pixbuf, inetutils, tiff CVEs. | ||
| RUN apt-get update \ | ||
| && apt-get upgrade -y \ |
There was a problem hiding this comment.
The final security-upgrade layer runs both apt-get upgrade -y and apt-get dist-upgrade -y back-to-back. dist-upgrade already performs upgrades, so the preceding upgrade is redundant (extra build time + another moving part). Consider dropping one of them (typically keep only upgrade unless you specifically need dist-upgrade).
Suggested change
| && apt-get upgrade -y \ |
| # Ensure setuptools >= 70.0.0 to address GHSA-cx63-2mw6-8hw5 | ||
| RUN pip3 install "setuptools>=70.0.0" | ||
| # Upgrade lxml to address GHSA-vfmq-68hx-4jfw | ||
| RUN pip3 install "setuptools>=70.0.0" "lxml>=5.3.2" |
There was a problem hiding this comment.
Installing lxml via pip can fall back to building from source when a prebuilt wheel isn’t available for the target architecture/OS (e.g., armhf/stretch). This Dockerfile doesn’t install common build deps for lxml (libxml2-dev/libxslt1-dev/zlib1g-dev), which can make the image build fail on those targets. To keep builds reliable, either install python3-lxml from apt for Debian-based images, or add the required system build dependencies / enforce binary wheels (fail fast if unavailable).
Suggested change
| RUN pip3 install "setuptools>=70.0.0" "lxml>=5.3.2" | |
| # Install lxml build dependencies so pip fallback source builds succeed | |
| RUN apt-get update \ | |
| && apt-get install -y --no-install-recommends \ | |
| libxml2-dev \ | |
| libxslt1-dev \ | |
| zlib1g-dev \ | |
| && rm -rf /var/lib/apt/lists/* \ | |
| && pip3 install "setuptools>=70.0.0" "lxml>=5.3.2" |
Comment on lines
+469
to
+476
| # Final system-level security upgrade: ensure every Debian package is at its | ||
| # latest patched version. This must run AFTER all apt-get install / dpkg -i | ||
| # steps so nothing slips through. | ||
| # Covers OpenSSL, openssh, libpng, gdk-pixbuf, inetutils, tiff CVEs. | ||
| RUN apt-get update \ | ||
| && apt-get upgrade -y \ | ||
| && apt-get dist-upgrade -y \ | ||
| && rm -rf /var/lib/apt/lists/* |
There was a problem hiding this comment.
The PR description is currently the unfilled template (missing rationale, implementation details, and concrete verification/testing steps). Please update the PR description with at least: what vulnerability(ies) are addressed, how the changes mitigate them, and how to build/test docker-ptf to validate the fix.
Contributor
|
Hi @auspham — heads up on a couple of things while you rebase this on master (it currently shows Test-side coordination: dropping Orphan files: the gnmic build block was the only consumer of these — they should also be removed in this PR, otherwise they linger as dead references:
Happy to send these as a follow-up PR or you can fold them in here, whichever you prefer. |
auspham
force-pushed
the
austinpham/37730545-fix-ptf-vulnerability
branch
from
April 30, 2026 01:53
c7e0d4f to
85d315e
Compare
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com>
auspham
force-pushed
the
austinpham/37730545-fix-ptf-vulnerability
branch
from
April 30, 2026 01:55
85d315e to
4614287
Compare
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
hdwhdw
approved these changes
Apr 30, 2026
Comment on lines
+456
to
+464
| # Final system-level security upgrade: ensure every Debian package is at its | ||
| # latest patched version. This must run AFTER all apt-get install / dpkg -i | ||
| # steps so nothing slips through. | ||
| # Covers OpenSSL, openssh, libpng, gdk-pixbuf, inetutils, tiff CVEs. | ||
| RUN apt-get update \ | ||
| && apt-get upgrade -y \ | ||
| && apt-get dist-upgrade -y \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
8 tasks
yejianquan
pushed a commit
that referenced
this pull request
May 2, 2026
Why I did it Cherry-pick #27059 CVE Package Why unfixable GHSA-x744-4wpc-v9h2 (HIGH) github.com/docker/docker v28.5.2 → needs v29.3.1 v29.3.1 doesn't exist as a Go module tag; Docker moved to moby/moby/v2 but gnmic's source code imports the old path GHSA-pxq6-2prw-chj9 (MEDIUM) github.com/docker/docker v28.5.2 → needs v29.3.1 Same reason as above GHSA-vffh-x6r8-xx99 (MEDIUM) github.com/prometheus/prometheus v0.306.0 → needs v0.311.2+ Upgrading pulls in k8s.io/kube-openapi which has a broken transitive dep on go-openapi/testify/v2/assert/yaml (module doesn't exist), so go mod tidy fails Work item tracking Microsoft ADO (number only): How I did it Remove gnmic package related Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com>
|
|
||
| # Build gnmic from source with upgraded deps to address known CVEs | ||
| COPY gocloud-patches/ /tmp/gocloud-patches/ | ||
| RUN GNMIC_VERSION=v0.43.0 \ |
Contributor
There was a problem hiding this comment.
could we not just try upgrading this rather than removing a testing framework?? 0.45 is out @yejianquan
mhchann
pushed a commit
to mhchann/sonic-buildimage
that referenced
this pull request
May 7, 2026
Why I did it Gnmic introduces several unfixable vulnerabilities CVE Package Why unfixable GHSA-x744-4wpc-v9h2 (HIGH) github.com/docker/docker v28.5.2 → needs v29.3.1 v29.3.1 doesn't exist as a Go module tag; Docker moved to moby/moby/v2 but gnmic's source code imports the old path GHSA-pxq6-2prw-chj9 (MEDIUM) github.com/docker/docker v28.5.2 → needs v29.3.1 Same reason as above GHSA-vffh-x6r8-xx99 (MEDIUM) github.com/prometheus/prometheus v0.306.0 → needs v0.311.2+ Upgrading pulls in k8s.io/kube-openapi which has a broken transitive dep on go-openapi/testify/v2/assert/yaml (module doesn't exist), so go mod tidy fails We need to temporarily remove this from docker-ptf to avoid problem Work item tracking Microsoft ADO (number only): 37730545 How I did it Remove this package from Dockerfile Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com> Signed-off-by: mhchann <mhchann082@gmail.com>
8 tasks
ronan-nexthop
added a commit
to nexthop-ai/sonic-buildimage
that referenced
this pull request
May 13, 2026
PR sonic-net#27059 removed gnmic because three CVEs in v0.45.0's deps couldn't be patched cleanly via `go get @latest` overrides. Those dependency fixes have since landed on openconfig/gnmic main. Build from a pinned main commit (71878d1936327b96883488d5f7a7584b1dda9bf1) so docker-ptf has gnmic available again for gNMI testing while we wait for the next tagged release. Signed-off-by: Ronan Mac Fhlannchadha <ronan@nexthop.ai>
lguohan
pushed a commit
that referenced
this pull request
Jun 3, 2026
#### Why I did it Two related changes to `docker-ptf/Dockerfile.j2`: **1. Re-add gnmic, built from a pinned upstream main commit.** `docker-ptf` previously shipped gnmic (added in #25537, switched to from-source build with dep overrides shortly after). In #27059 it was removed because three CVEs in v0.45.0's dependency chain could not be patched cleanly via `go get @latest` overrides: - GHSA-x744-4wpc-v9h2 / GHSA-pxq6-2prw-chj9 — `github.com/docker/docker` needed a version that didn't exist as a Go module tag (Docker moved to `moby/moby/v2`, gnmic still imported the old path). - GHSA-vffh-x6r8-xx99 — `github.com/prometheus/prometheus` upgrade pulled in `k8s.io/kube-openapi` with a broken transitive dep, breaking `go mod tidy`. Those fixes have all since landed on `openconfig/gnmic` main (grpc 1.79.3, otel-sdk 1.43.0, go-git 5.19.0, docker→moby/moby/v2 migration, prometheus v0.311.3). The pinned commit `653dc5dd4ddcd3bd4197317875a10c1ce8b06653` is the merge of [openconfig/gnmic#872](openconfig/gnmic#872) into main and additionally closes [CVE-2026-42151](GHSA-wg65-39gg-5wfj) (prometheus → v0.311.3). To unblock gNMI testing in docker-ptf before the next tagged gnmic release, re-add gnmic by building from that pinned main commit. **2. Bump Go toolchain to 1.25.10.** Go 1.25.10 is the 2026-05-07 stdlib security release ([golang-announce qcCIEXso47M](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)). It closes five DoS/crash CVEs present in 1.25.9, all of which currently end up in the from-source binaries this Dockerfile builds (grpcurl, gnoic, gnmic): - CVE-2026-33811 — `net.LookupCNAME` double-free (cgo resolver) - CVE-2026-33814 — `net/http` HTTP/2 `SETTINGS_MAX_FRAME_SIZE=0` DoS (most relevant for gRPC tools) - CVE-2026-39820 — `net/mail.ParseAddress`/`ParseDate` DoS - CVE-2026-39836 — `net.Dial`/`LookupPort` panic on Windows with NUL byte - CVE-2026-42499 — `net/mail.consumePhrase` DoS #### How I did it `dockers/docker-ptf/Dockerfile.j2`: - New `RUN` block that clones `openconfig/gnmic`, checks out commit `653dc5dd`, and runs `go build -o /usr/local/bin/gnmic .` — no `go get @latest` chains, no gocloud patch; trust upstream's vendored deps. Cleans up `/tmp/gnmic`, `\$GOPATH/pkg/mod`, and the Go build cache after the build to keep layer size in check. Placed right before "Remove Go toolchain to reduce image size" so the Go toolchain is still available. - Bumped `GO_VERSION=1.25.9 → 1.25.10` and the matching armv6l/arm64/amd64 SHA256s (taken from `https://go.dev/dl/?mode=json` on 2026-05-14). The gnmic pin is temporary — the intent is to swap back to a tagged release once `openconfig/gnmic` cuts one that contains the dep fixes from #864 and #872. #### How to verify it Build the docker-ptf image and confirm gnmic is on PATH and links against the patched toolchain and prometheus: \`\`\` $ docker run -it --rm --entrypoint bash docker-ptf:latest root@...:~# gnmic version \`\`\` Expected: `gnmic` reports a version string referencing commit `653dc5dd` (or whatever the pinned SHA is). The compiled binaries (grpcurl, gnoic, gnmic) embed Go 1.25.10 stdlib, and gnmic links against `prometheus/prometheus v0.311.3`.
purush-nexthop
pushed a commit
to nexthop-ai/sonic-buildimage
that referenced
this pull request
Jun 10, 2026
…t#27340) #### Why I did it Two related changes to `docker-ptf/Dockerfile.j2`: **1. Re-add gnmic, built from a pinned upstream main commit.** `docker-ptf` previously shipped gnmic (added in sonic-net#25537, switched to from-source build with dep overrides shortly after). In sonic-net#27059 it was removed because three CVEs in v0.45.0's dependency chain could not be patched cleanly via `go get @latest` overrides: - GHSA-x744-4wpc-v9h2 / GHSA-pxq6-2prw-chj9 — `github.com/docker/docker` needed a version that didn't exist as a Go module tag (Docker moved to `moby/moby/v2`, gnmic still imported the old path). - GHSA-vffh-x6r8-xx99 — `github.com/prometheus/prometheus` upgrade pulled in `k8s.io/kube-openapi` with a broken transitive dep, breaking `go mod tidy`. Those fixes have all since landed on `openconfig/gnmic` main (grpc 1.79.3, otel-sdk 1.43.0, go-git 5.19.0, docker→moby/moby/v2 migration, prometheus v0.311.3). The pinned commit `653dc5dd4ddcd3bd4197317875a10c1ce8b06653` is the merge of [openconfig/gnmic#872](openconfig/gnmic#872) into main and additionally closes [CVE-2026-42151](GHSA-wg65-39gg-5wfj) (prometheus → v0.311.3). To unblock gNMI testing in docker-ptf before the next tagged gnmic release, re-add gnmic by building from that pinned main commit. **2. Bump Go toolchain to 1.25.10.** Go 1.25.10 is the 2026-05-07 stdlib security release ([golang-announce qcCIEXso47M](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)). It closes five DoS/crash CVEs present in 1.25.9, all of which currently end up in the from-source binaries this Dockerfile builds (grpcurl, gnoic, gnmic): - CVE-2026-33811 — `net.LookupCNAME` double-free (cgo resolver) - CVE-2026-33814 — `net/http` HTTP/2 `SETTINGS_MAX_FRAME_SIZE=0` DoS (most relevant for gRPC tools) - CVE-2026-39820 — `net/mail.ParseAddress`/`ParseDate` DoS - CVE-2026-39836 — `net.Dial`/`LookupPort` panic on Windows with NUL byte - CVE-2026-42499 — `net/mail.consumePhrase` DoS #### How I did it `dockers/docker-ptf/Dockerfile.j2`: - New `RUN` block that clones `openconfig/gnmic`, checks out commit `653dc5dd`, and runs `go build -o /usr/local/bin/gnmic .` — no `go get @latest` chains, no gocloud patch; trust upstream's vendored deps. Cleans up `/tmp/gnmic`, `\$GOPATH/pkg/mod`, and the Go build cache after the build to keep layer size in check. Placed right before "Remove Go toolchain to reduce image size" so the Go toolchain is still available. - Bumped `GO_VERSION=1.25.9 → 1.25.10` and the matching armv6l/arm64/amd64 SHA256s (taken from `https://go.dev/dl/?mode=json` on 2026-05-14). The gnmic pin is temporary — the intent is to swap back to a tagged release once `openconfig/gnmic` cuts one that contains the dep fixes from sonic-net#864 and sonic-net#872. #### How to verify it Build the docker-ptf image and confirm gnmic is on PATH and links against the patched toolchain and prometheus: \`\`\` $ docker run -it --rm --entrypoint bash docker-ptf:latest root@...:~# gnmic version \`\`\` Expected: `gnmic` reports a version string referencing commit `653dc5dd` (or whatever the pinned SHA is). The compiled binaries (grpcurl, gnoic, gnmic) embed Go 1.25.10 stdlib, and gnmic links against `prometheus/prometheus v0.311.3`.
roger530-ho
pushed a commit
to roger530-ho/sonic-buildimage
that referenced
this pull request
Jun 23, 2026
Why I did it Gnmic introduces several unfixable vulnerabilities CVE Package Why unfixable GHSA-x744-4wpc-v9h2 (HIGH) github.com/docker/docker v28.5.2 → needs v29.3.1 v29.3.1 doesn't exist as a Go module tag; Docker moved to moby/moby/v2 but gnmic's source code imports the old path GHSA-pxq6-2prw-chj9 (MEDIUM) github.com/docker/docker v28.5.2 → needs v29.3.1 Same reason as above GHSA-vffh-x6r8-xx99 (MEDIUM) github.com/prometheus/prometheus v0.306.0 → needs v0.311.2+ Upgrading pulls in k8s.io/kube-openapi which has a broken transitive dep on go-openapi/testify/v2/assert/yaml (module doesn't exist), so go mod tidy fails We need to temporarily remove this from docker-ptf to avoid problem Work item tracking Microsoft ADO (number only): 37730545 How I did it Remove this package from Dockerfile Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com>
roger530-ho
pushed a commit
to roger530-ho/sonic-buildimage
that referenced
this pull request
Jun 23, 2026
…t#27340) #### Why I did it Two related changes to `docker-ptf/Dockerfile.j2`: **1. Re-add gnmic, built from a pinned upstream main commit.** `docker-ptf` previously shipped gnmic (added in sonic-net#25537, switched to from-source build with dep overrides shortly after). In sonic-net#27059 it was removed because three CVEs in v0.45.0's dependency chain could not be patched cleanly via `go get @latest` overrides: - GHSA-x744-4wpc-v9h2 / GHSA-pxq6-2prw-chj9 — `github.com/docker/docker` needed a version that didn't exist as a Go module tag (Docker moved to `moby/moby/v2`, gnmic still imported the old path). - GHSA-vffh-x6r8-xx99 — `github.com/prometheus/prometheus` upgrade pulled in `k8s.io/kube-openapi` with a broken transitive dep, breaking `go mod tidy`. Those fixes have all since landed on `openconfig/gnmic` main (grpc 1.79.3, otel-sdk 1.43.0, go-git 5.19.0, docker→moby/moby/v2 migration, prometheus v0.311.3). The pinned commit `653dc5dd4ddcd3bd4197317875a10c1ce8b06653` is the merge of [openconfig/gnmic#872](openconfig/gnmic#872) into main and additionally closes [CVE-2026-42151](GHSA-wg65-39gg-5wfj) (prometheus → v0.311.3). To unblock gNMI testing in docker-ptf before the next tagged gnmic release, re-add gnmic by building from that pinned main commit. **2. Bump Go toolchain to 1.25.10.** Go 1.25.10 is the 2026-05-07 stdlib security release ([golang-announce qcCIEXso47M](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)). It closes five DoS/crash CVEs present in 1.25.9, all of which currently end up in the from-source binaries this Dockerfile builds (grpcurl, gnoic, gnmic): - CVE-2026-33811 — `net.LookupCNAME` double-free (cgo resolver) - CVE-2026-33814 — `net/http` HTTP/2 `SETTINGS_MAX_FRAME_SIZE=0` DoS (most relevant for gRPC tools) - CVE-2026-39820 — `net/mail.ParseAddress`/`ParseDate` DoS - CVE-2026-39836 — `net.Dial`/`LookupPort` panic on Windows with NUL byte - CVE-2026-42499 — `net/mail.consumePhrase` DoS #### How I did it `dockers/docker-ptf/Dockerfile.j2`: - New `RUN` block that clones `openconfig/gnmic`, checks out commit `653dc5dd`, and runs `go build -o /usr/local/bin/gnmic .` — no `go get @latest` chains, no gocloud patch; trust upstream's vendored deps. Cleans up `/tmp/gnmic`, `\$GOPATH/pkg/mod`, and the Go build cache after the build to keep layer size in check. Placed right before "Remove Go toolchain to reduce image size" so the Go toolchain is still available. - Bumped `GO_VERSION=1.25.9 → 1.25.10` and the matching armv6l/arm64/amd64 SHA256s (taken from `https://go.dev/dl/?mode=json` on 2026-05-14). The gnmic pin is temporary — the intent is to swap back to a tagged release once `openconfig/gnmic` cuts one that contains the dep fixes from sonic-net#864 and sonic-net#872. #### How to verify it Build the docker-ptf image and confirm gnmic is on PATH and links against the patched toolchain and prometheus: \`\`\` $ docker run -it --rm --entrypoint bash docker-ptf:latest root@...:~# gnmic version \`\`\` Expected: `gnmic` reports a version string referencing commit `653dc5dd` (or whatever the pinned SHA is). The compiled binaries (grpcurl, gnoic, gnmic) embed Go 1.25.10 stdlib, and gnmic links against `prometheus/prometheus v0.311.3`.
qiluo-msft
pushed a commit
that referenced
this pull request
Jun 23, 2026
…rabilities (#28038) Why I did it S360 / Trivy container scanning flags the docker-ptf image's gnmic binary (/usr/local/bin/gnmic) with HIGH golang.org/x/* CVEs. The gnmic build was changed (#27059) to build from a pinned upstream commit (653dc5dd), which locks older modules — golang.org/x/crypto v0.50.0, x/net v0.53.0, x/text v0.36.0, x/sys v0.43.0. Unlike the grpcurl build step in the same Dockerfile, the gnmic step did not upgrade these, so the vulnerable versions ship in the image. Work item tracking Microsoft ADO: 38538287 How I did it In dockers/docker-ptf/Dockerfile.j2, added go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest && go mod tidy before go build in the gnmic RUN block, matching the existing grpcurl step. How to verify it Build target/docker-ptf.gz, load it, and scan: trivy image docker-ptf:latest --scanners vuln --ignore-unfixed usr/local/bin/gnmic should report 0 fixable vulns (x/* upgraded to latest). Which release branch to backport (provide reason below if selected) Tested branch (Please provide the tested image version) docker-ptf built from this branch on latest master Description for the changelog [docker-ptf]: Upgrade gnmic golang.org/x/* dependencies to address HIGH CVEs
xdqi
pushed a commit
to canonical/sonic-buildimage
that referenced
this pull request
Jul 6, 2026
Why I did it Gnmic introduces several unfixable vulnerabilities CVE Package Why unfixable GHSA-x744-4wpc-v9h2 (HIGH) github.com/docker/docker v28.5.2 → needs v29.3.1 v29.3.1 doesn't exist as a Go module tag; Docker moved to moby/moby/v2 but gnmic's source code imports the old path GHSA-pxq6-2prw-chj9 (MEDIUM) github.com/docker/docker v28.5.2 → needs v29.3.1 Same reason as above GHSA-vffh-x6r8-xx99 (MEDIUM) github.com/prometheus/prometheus v0.306.0 → needs v0.311.2+ Upgrading pulls in k8s.io/kube-openapi which has a broken transitive dep on go-openapi/testify/v2/assert/yaml (module doesn't exist), so go mod tidy fails We need to temporarily remove this from docker-ptf to avoid problem Work item tracking Microsoft ADO (number only): 37730545 How I did it Remove this package from Dockerfile Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com>
roger-nexthop
pushed a commit
to nexthop-ai/sonic-buildimage
that referenced
this pull request
Jul 12, 2026
…rabilities (sonic-net#28038) Why I did it S360 / Trivy container scanning flags the docker-ptf image's gnmic binary (/usr/local/bin/gnmic) with HIGH golang.org/x/* CVEs. The gnmic build was changed (sonic-net#27059) to build from a pinned upstream commit (653dc5dd), which locks older modules — golang.org/x/crypto v0.50.0, x/net v0.53.0, x/text v0.36.0, x/sys v0.43.0. Unlike the grpcurl build step in the same Dockerfile, the gnmic step did not upgrade these, so the vulnerable versions ship in the image. Work item tracking Microsoft ADO: 38538287 How I did it In dockers/docker-ptf/Dockerfile.j2, added go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest && go mod tidy before go build in the gnmic RUN block, matching the existing grpcurl step. How to verify it Build target/docker-ptf.gz, load it, and scan: trivy image docker-ptf:latest --scanners vuln --ignore-unfixed usr/local/bin/gnmic should report 0 fixable vulns (x/* upgraded to latest). Which release branch to backport (provide reason below if selected) Tested branch (Please provide the tested image version) docker-ptf built from this branch on latest master Description for the changelog [docker-ptf]: Upgrade gnmic golang.org/x/* dependencies to address HIGH CVEs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
Gnmic introduces several unfixable vulnerabilities
We need to temporarily remove this from docker-ptf to avoid problem
Work item tracking
How I did it
Remove this package from Dockerfile
How to verify it
Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Description for the changelog
Link to config_db schema for YANG module changes
A picture of a cute animal (not mandatory but encouraged)